Create 3D animated logos for free → Studio Neostream

Privacy Policy

Last updated: August 2026

1. Who we are

NeoStreamShop (“we”, “us”, “our”) is a company established in France. We operate the website and services at widgets.neostreamshop.com and related domains (the “Site”), which allow users to use interactive widgets and mini-games on their Twitch, Kick and YouTube streams.

We are the data controller for the personal data we collect through the Site. Our contact details are provided at the end of this policy.

2. What data we collect

We collect and process the following categories of data when you use our services:

  • Account and identity (Twitch): When you sign in with Twitch, we receive and store your Twitch user ID, login name, display name, profile picture URL, and OAuth tokens needed to provide the service. We do not request or store your Twitch email address.
  • Account and identity (Kick): If you sign in with Kick or link Kick to your account, we store your Kick user ID, username, display name, profile picture URL, and OAuth tokens needed to subscribe to Kick events for your widgets.
  • Account and identity (Google/YouTube): If you choose to link your Google/YouTube account, we receive and store your Google user ID, display name, and profile picture URL, as well as tokens needed to maintain the link. We do not request your Google email address and we do not access your YouTube channel content, videos, or chat.
  • Widget and service usage: We store which widgets you have activated, your widget configurations, widget overlay store data, activation/purchase records needed to provide the products you own, and activation codes you use.
  • Donation integrations: If you connect Ko-fi or Buy Me a Coffee, we store a webhook key and the verification secret you provide so we can receive tip events. Donor name, amount and message from those webhooks are processed in real time to trigger your widgets; we do not keep a donation history.
  • Stream events and chat (EventSub / Kick events): To make widgets react on stream, we receive events from Twitch (including follows, subscriptions, cheers, raids, channel-point redemptions, stream online/offline, and chat messages via EventSub channel.chat.message) and from Kick (including chat, follows, subscriptions, rewards and similar events). These events include viewer usernames, user IDs, badges and message text. They are forwarded in real time to your overlay over our WebSocket server. We do not archive chat or event logs as a message history.
  • Persistent sign-in (remember-me): If you accept cookies, we store a hashed sign-in token, its expiry, a truncated browser user-agent, and a truncated IP prefix (not the full IP) to keep you signed in for up to 30 days after you close the browser. This cookie is not set if you reject cookies.
  • Activity timestamp: We store last_seen_at, the time of your last authenticated visit to the Site, for security and to understand whether an account is active.
  • Session and technical data: When you use the Site, we use a session cookie and server-side sessions to keep you logged in during your visit. We may collect your IP address and browser/device information in short-lived security logs for fraud prevention and troubleshooting.

3. Why we use your data

We use your data to:

  • Create and manage your account and link your Twitch, Kick and (optionally) Google/YouTube identities.
  • Provide the widget and streaming services (e.g. display widgets on your stream, apply your settings, relay live events and chat commands to your overlay).
  • Process widget activations and purchases.
  • Keep you signed in across visits when you have accepted the persistent sign-in cookie.
  • Communicate with you about your account or the service (e.g. important updates on the Site) where necessary.
  • Improve, secure, and troubleshoot our services and to comply with legal obligations.

Our legal bases for processing are: performance of the contract (to provide the service you requested), consent (where you explicitly link Kick or Google/YouTube, connect a donation webhook, or accept the persistent sign-in cookie), and legitimate interests (security, fraud prevention, improvement of our services) or legal obligation where applicable.

4. Who we share your data with

We may share your data only as follows:

  • Twitch, Kick and Google: When you sign in or link accounts, we interact with Twitch, Kick and Google (YouTube) under their respective terms and privacy policies. They process your data according to their own policies; we only receive and store what is necessary for our service.
  • Donation providers: If you connect Ko-fi or Buy Me a Coffee, those providers send webhook events to us according to their own policies. We do not share your account data with them beyond the webhook URL you configure.
  • Service providers: We may use trusted providers for hosting, databases, and technical operations (e.g. servers, real-time delivery of widget events). These providers act on our instructions and are bound by confidentiality and data protection obligations.
  • Legal and safety: We may disclose data if required by law, to protect our rights or the safety of users, or in connection with a merger or sale of assets, in accordance with applicable law.

We do not sell your personal data to third parties.

5. How long we keep your data

We retain your account and widget data for as long as your account is active. You can delete your account at any time from Account Settings; we then delete or anonymise the personal data listed above. If you stop using the service without deleting your account, we may retain data for a limited period for legal, security, or backup purposes, after which it is deleted or anonymised. Session and technical logs are kept only as long as necessary for security and troubleshooting (typically no longer than required by applicable law). Persistent sign-in tokens expire after 30 days. Cookie consent is stored for up to 6 months.

6. Your rights (especially in the EU/EEA and France)

Under the General Data Protection Regulation (GDPR) and applicable French law, you have the right to:

  • Access: Obtain confirmation as to whether we process your data and a copy of that data.
  • Rectification: Have inaccurate data corrected.
  • Erasure: Request deletion of your data (“right to be forgotten”). You can delete your account yourself from Account Settings (when signed in). This deletes your profile, OAuth tokens, widget configurations, widget store, donation integrations and remember-me tokens, and revokes Twitch (and where possible Kick and Google) authorizations. You may also contact us using the details below.
  • Restriction: Request that we limit how we use your data in certain cases.
  • Data portability: Receive your data in a structured, commonly used format where technically feasible.
  • Object: Object to processing based on legitimate interests or for direct marketing.
  • Withdraw consent: Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.
  • Lodge a complaint: You have the right to lodge a complaint with a supervisory authority, in particular in the EU country of your residence. In France, this is the CNIL: www.cnil.fr.

To exercise these rights, please contact us using the details at the end of this policy. We will respond within the time limits required by law (e.g. one month under the GDPR).

7. Cookies and similar technologies

We use cookies as follows:

  • Strictly necessary session cookie (NSS_WM_SESSID): keeps you signed in during your visit and protects forms (CSRF). This cookie is required for the Site to work and does not require consent.
  • Persistent sign-in cookie (nss_remember, 30 days): set only if you click Accept on the cookie banner. It lets us restore your session after you close the browser. If you click Reject, this cookie is not set and any existing remember-me cookie is deleted.
  • Cookie consent (nss_cookie_consent, 6 months): stores your Accept or Reject choice so we can honour it.

We do not use advertising or third-party tracking cookies for marketing on this Site. You can change your choice later via Cookie settings in the footer.

8. International transfers

Your account data is hosted and processed in France and the European Economic Area. Live widget events (chat, alerts, donations) are delivered through our self-hosted WebSocket server (Soketi) in the EEA. We do not use Pusher Cloud for this delivery. Twitch, Kick, Google, Ko-fi and Buy Me a Coffee process the data you share with them according to their own policies and may be located outside the EEA; their transfers are their responsibility. If we ever add other services located outside the EEA, we will ensure appropriate safeguards (e.g. standard contractual clauses or adequacy decisions) are in place as required by the GDPR.

9. Security

We implement appropriate technical and organisational measures to protect your data against unauthorised access, loss, or alteration. Access tokens and sensitive credentials are stored in an encrypted form. We regularly review our security practices.

10. Children

Our service is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us and we will delete it promptly.

11. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version on this page and change the “Last updated” date. For material changes, we may notify you through the Site where appropriate. We encourage you to review this policy periodically.

12. Contact us

For any questions about this Privacy Policy, your personal data, or to exercise your rights, please contact us:

We will process your request in accordance with applicable data protection law.